I have OpenID connect authentication in my application (usingn pega 8.5.5) and it is working fine, until i found accesstoken expiration problem.
After an authentication succeed, The Access Token received from the external system has expiration time. Each time we refresh the User Token, we have to retrieve and pass the AccessToken to get the userinfo.
If the AccessToken is expired, we have to refresh the AccessToken and pass the latest AccessToken. How do we refresh the AccessToken ?. Is there any API available to refresh the AccessToken. I am looking at making a Connect-REST call to Token API to retrieve the AccessToken. To do this i need to retrieve the RefreshToken sent from IDP. But I am not seeing any Pega API to retrieve the RefreshToken for the current user. I looked at the AccessToken Blob in DB, RefreshToken is encrypted. Unable to retrieve the decrypted value of RefreshToken.
i alsotrying to call com.pega.pegarules.pub.connect.oauth2.OAuth2Client.RevokeToken(), this function delete the Data-Admin-Security-OAuth2-AccessToken, but now i am stuck how to register new Data-Admin-Security-OAuth2-AccessToken with the new access token.
is there another way to achieve how to refresh or get new access token to Data-Admin-Security-OAuth2-AccessToken?.
In Pega Platform, when an OAuth 2.0 client application requests a new access token using the refresh token grant type, the response includes the new access token as well as the refresh token. You can choose the refresh token issuance mechanism and the expiration of various tokens issued by Pega Platform in the Token Management section. However, retrieving the Refresh Token directly from the IDP or decrypting the Refresh Token from the AccessToken Blob in DB is not supported out of the box. You might need to customize your application to handle these scenarios. Please note that any customization should comply with the security standards and guidelines of your organization.
This is a GenAI-powered tool. All generated answers require validation against the provided references.
Hello @SadiaB17577823 as the knowledge used in my previous answer is 2 years old, I thought I’d run your question through our current knowledge base. I don’t think I have found any solution for you, but you might be interested in the re-wording, and it may help you come up with your own solution:
As always, please verify the details carefully against the references listed at the bottom as these were generated by our AI agent:
Manually creating a new instance of the OAuth2 access token record after calling RevokeToken() is not a supported approach. When a token is revoked, the platform performs several internal operations beyond simply deleting the record — including invalidating cached state and blacklisting the token identifier. As a result, a manually created token record would not be treated as valid by the system.
The recommended approach is to allow Pega’s standard OAuth2 authentication flow to handle token generation. This ensures that any new token is properly signed, encrypted, and registered by the platform.
In practice:
If you are using a Connect-REST integration with an authentication profile, simply re-invoking the connector will trigger Pega to automatically request and store a fresh token.
If you need to programmatically obtain a new token, this should be done by calling the OAuth2 token endpoint (/oauth/token) with the appropriate credentials and grant type. The platform will then create and manage the new token correctly.
We would advise against attempting to manually populate and save token records, as this bypasses the platform’s security and validation mechanisms and may lead to unpredictable behavior.
It’s 2 years a go, i have to jump again what i did last time, and i think i can’t fix it on pega. But the solution was out of the box (but i forget it is or not, hopefully it is), i think we add the access token expiration time more than the timeout session time on the IDP settings.
Thanks @MusaW148
We were able to address it. We made sure we get a refresh token as part of SSO using OIDC.
That refresh token is making sure new token is requested automatically in case if existing token is expired.
On the Authentication service used for SSO, we added an additional scope called “offline_access”. This makes sure we get a refresh token as part of the SSO login itself. Once you have a refresh token, pega can use it to request for a new access token in case of an expiry to generate a new token. This makes sure there is always an active access token when needed.
This is a GenAI-powered tool. All generated answers require validation against the provided references.